Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
GitLab patches critical unauthenticated code execution flaw
TL;DR - GitLab patched CVE-2026-110264, a critical integer overflow issue in its regular expression compiler. - GitLab says an unauthenticated user could execute arbitrary code on a vulnerable GitLab server. - The vulnerability has a CVSS score of 10.0 and affects GitLab CE and EE across multiple release branches. - GitLab recommends that affected self-managed installations upgrade immediately. - GitLab.com is already running the patched version.
What happened#
GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 on October 21, 2026. The releases contain bug and security fixes for GitLab Community Edition and Enterprise Edition. GitLab strongly recommends that all self-managed installations upgrade to one of these versions immediately. The company’s critical patch release notice identifies CVE-2026-110264 as an integer overflow issue in the regular expression compiler.
GitLab says that, under certain conditions, the flaw could have allowed an unauthenticated user to execute arbitrary code on the GitLab server when compiling a specially crafted regular expression. The vendor rates the vulnerability Critical and assigns it a CVSS score of 10.0, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
The fix was backported to GitLab CE and EE versions 18.11.13, 19.0.10, 19.1.9, and 19.2.9, in addition to the newer patch releases. GitLab credits joaxcar with reporting the vulnerability through its HackerOne bug bounty program.
Are you affected#
GitLab lists the following affected ranges for CE and EE:
- All versions from 7.0 before 18.11.13
- 19.0 before 19.0.10
- 19.1 before 19.1.9
- 19.2 before 19.2.9
- 19.3 before 19.3.6
- 19.4 before 19.4.3
- 19.5 before 19.5.1
When GitLab does not identify a specific deployment type, it says all deployment types are affected. Administrators should compare the installed GitLab version with the affected ranges and the fixed versions listed in the vendor notice.
GitLab.com is already running the patched version, according to GitLab. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes and do not need to take action, according to the same notice. These statements concern the deployment conditions identified by GitLab and do not establish that other self-managed installations are unaffected.
BleepingComputer reports that the issue involves the regular expression compiler, described in its coverage as a background engine that parses and validates regular expressions in configuration files. That description is reported by BleepingComputer, while GitLab’s notice confirms the integer overflow and arbitrary code execution impact.
What is confirmed and what is reported#
| Claim | Source | Status |
|---|---|---|
| GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 on October 21, 2026. | GitLab | Confirmed |
| CVE-2026-110264 is an integer overflow issue in the regular expression compiler affecting GitLab CE and EE. | GitLab | Confirmed |
| Under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server. | GitLab | Confirmed |
| The vulnerability has a CVSS score of 10.0. | GitLab | Confirmed |
| GitLab credits joaxcar with reporting the vulnerability through HackerOne. | GitLab | Confirmed |
| More than 2,700 GitLab CE instances are exposed online. | BleepingComputer | Reported |
| The flaw involves a background engine that parses and validates regular expressions in configuration files. | BleepingComputer | Reported |
| CVE-2026-110264 was reported by a researcher using the joaxcar handle. | BleepingComputer | Reported |
The current GitLab notice does not state that CVE-2026-110264 is being actively exploited. CISA separately lists CVE-2026-85706, a GitLab path traversal vulnerability, in its Known Exploited Vulnerabilities Catalog. CISA says that vulnerability is known to have been exploited, requires forensic triage under BOD 26-04, and was added on 2026-09-11. That CISA entry concerns CVE-2026-85706, not CVE-2026-110264. See CISA’s alert and the catalog entry.
What defenders should do now#
- Identify all self-managed GitLab CE and EE installations, including deployment types covered by the vendor notice.
- Compare each installation’s version with GitLab’s affected ranges for CVE-2026-110264.
- Upgrade affected installations to the applicable fixed version: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13, as appropriate.
- Review GitLab’s two listed threat detections for self-managed instances, named “Onigmo native worker crash” and “Org mode render error burst.” GitLab released these detections to support customers with self-managed instances.
- Treat CVE-2026-85706 as a separate priority. CISA recommends risk-based vulnerability management for vulnerabilities in its KEV Catalog and identifies forensic triage requirements for that issue.
- Record the installed version, patch applied, and any relevant detection results as part of the organization’s vulnerability management process.
This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.
Sources
- Primary notice: docs.gitlab.com
- Primary notice: cisa.gov
- Primary notice: cisa.gov
- Report: bleepingcomputer.com